Chapter 4 Safety Principles for France s Pressurised Water Reactors

Transcription

1 Chapter 4 Safety Principles for France s Pressurised Water Reactors 4.1. Concept of severe accident A severe accident or core melt accident at a PWR is an accident during which the reactor fuel is significantly damaged with more or less extensive melting of the reactor core. This melting is caused by extended loss of core cooling by the coolant and, in turn, a significant increase in the temperature of the exposed fuel rods. Owing to the preventive measures in place (see Section 3), such an accident occurs only following a series of failures (multiple human or equipment failures). The failure, in 1979, of the second reactor at the Three Mile Island nuclear power plant nevertheless confirmed that a series of failures could lead to a core melt accident. Fortunately, the accident did not have significant environmental consequences (Section 7.1). The Fukushima-Daiichi accident in 2011 showed that external hazards (tsunami triggered by an earthquake) with a ma gnitude greater than a facility s design basis could also lead to core meltdowns. Unfortunately, this accident resulted in significant amounts of radioactivity being released into the environment. If core degradation cannot be stopped inside a reactor vessel through cooling of the degraded core (in-vessel reflooding with coolant), the core melt accident may ultimately lead to loss of containment integrity and large releases of radioactivity into the environment. Because of the significant consequences of such releases into the environment, and in accordance with the defence-in-depth approach (see Section 3), many efforts are being made to study this type of accident and mitigate its consequences. The first step

2 52 Nuclear Power Reactor Core Melt Accidents in studying core melt accidents involves identifying the main scenarios that may lead to them. These scenarios are described in the following section Accident scenarios that may lead to core melt This section describes the main accident scenarios as they appear in the light of level 1 probabilistic safety assessments (level 1 PSAs). Each scenario involves a series of equipment or human failures that may lead to core uncovery and, if core cooling cannot be restored, to core melt. The severity of core melt is not specified in the following presentation. Some scenarios may result in nearly total fuel melt while others may simply lead to very limited fuel degradation. The magnitude and kinetics of the corresponding releases are assessed during level 2 PSAs. These assessments are presented in Section 4.4. Accident sequences likely to result from external hazards are not described here; such PSAs are now in the course of development Description of PSA level 1 accident scenarios Introduction As mentioned in Section 3.3, the aim of level 1 PSAs is to determine which accident scenarios ranging from simple cladding failure to fuel melt result in partial or total fuel degradation. EDF develops such PSAs for four reactor types (900 MWe, 1300 MWe, N4 and EPR). These PSAs constitute reference studies used to support safety analyses. IRSN develops its own level 1 PSAs for the 900 and 1300 MWe series and the EPR in order to analyse EDF s findings more deeply and identify specific points that need to be examined more in detail. The scenarios presented on the following pages are based on the findings of the level 1 PSAs developed by EDF and IRSN for the 900 MWe reactors. The description and operation of the systems of these reactors that come into play during normal and accident situations are presented in Chapter 2 (particularly in Section and Figures 2.6 and 2.7). The acronyms for some systems (especially FPCCS, RHRS, CSS, CVCS, CCWS, EFWS, U5, SIS) are defined in Chapter 2 as well. The following description of the accident scenarios is for illustrative purposes only. It does not aim to provide all the details given in the PSAs Loss-of-coolant accidents (LOCA): large breaks, intermediate breaks and small breaks LOCA are initiated by breaks in the reactor-coolant system (RCS) or any of the connecting circuits. These breaks do not include vessel failure or failure of one or more steam generator tubes (the latter case is discussed in Section ). Such breaks cause reactor coolant to leak out and the RCS to become depressurised. The level 1 PSA

3 Safety Principles for France s Pressurised Water Reactors 53 distinguishes several scenarios depending on the reactor s initial state and the size and location of the break. In the event of a LOCA, the depressurisation of the RCS induces an automatic reactor trip and automatically initiates the safety injection system (SIS). In the case of large breaks, the rapid increase in pressure inside the containment automatically initiates the containment spray system (CSS). The protection and engineered safety systems must perform the following functions to mitigate the consequences of the accident: reactivity control; maintaining the water inventory in the reactor vessel; removal of the residual heat generated by the fuel. Reactivity control is provided by the automatic reactor trip and the injection of borated water into the core. Water is maintained inside the reactor vessel by the SIS, which operates in two phases: an injection phase and a recirculation phase. In the first phase, the SIS injects water from the RWST. In the second, it recirculates water drawn from the sumps at the bottom of the containment building. The heat generated by the fuel is removed through cooling by the water flowing inside the vessel (by the break, which allows the water heated by the fuel to be removed, by the steam generators and, in the longer term, by the RHRS). However, this system can be used only if the RCS break is not too big. When the SIS recirculates the water contained in the sumps in the containment building, heat is removed from the containment building by the CSS. The RHRS and CSS are cooled by the CCWS 1. The accident scenarios that lead to core melt assume the failure of one or more engineered safety systems. Scenarios involving one of the following failures are considered for a reactor initially at power: failure of the SIS; failure of the CSS while in the injection and/or recirculation phase. The level 1 PSA accident scenarios for reactor-trip states differ depending on the initial state of the RCS (closed, partially open or completely open). Whatever the case, however, they are always associated with failure to maintain a sufficient level of water in the RCS to cool the core following a human error or an equipment failure. 1. Except at Fessenheim, where the CSS is cooled directly by the ESWS (see Section ).

4 54 Nuclear Power Reactor Core Melt Accidents Loss-of-coolant accidents with containment bypass (V-LOCA) These accidents, which are caused by loss of coolant via a break occurring outside the containment building but in a loop connected to the RCS loop and not isolated from it, have two specific characteristics: since coolant is lost outside the containment, the recirculation phase of safety injection is not possible; there is a risk of fission products being released directly outside the containment as long as the break is not isolated from the RCS. An example of an accident of this type is a break in the thermal barrier of any of the RCPs Steam-line break accidents (FWLB, SLB) These accidents are caused by: small or large breaks occurring in a steam generator feedwater line (FWLB) upstream of the isolation valve of the MFWS and EFWS systems (see Figures 2.6 and 2.7). These lines are located inside the containment (the lines located outside the containment have check valves to isolate breaks and prevent the steam ge nerators from being completely emptied); small or large breaks occurring in a steam line connected to the secondary side of a steam generator (SLB). Breaks may occur inside or outside the containment. Those that occur outside it can be localised either between the containment and the steam isolation valves or downstream of the steam isolation valves. Breaks that occur downstream of the valves can be isolated by closing the valves; a dump valve on the secondary loops becoming stuck open. When a break in the feedwater line of a steam generator occurs, the steam ge nerator is rapidly voided of water and the flow rate of the steam in the generator s secondary side rises suddenly. This results in increased removal of heat from the RCS by the affected steam generator, initiation of an automatic reactor trip and startup of the SIS. Operators must isolate the affected steam generator by closing the steam isolation valves to prevent the other steam generators from voiding and thus preserve the possibility of cooling by the secondary loops. A break on a steam line connected to the secondary side of a steam generator will cause the flow of steam in the secondary loops to suddenly rise. This causes more heat to be removed from the RCS, which in turn causes the RCS pressure and temperature to drop. The effect of this cooling is that it reduces the available reactivity shutdown margin. If a large break occurs, the SIS is rapidly initiated (automatic injection of highly borated water) and the isolation valves on the steam lines automatically close to isolate the steam generators.

5 Safety Principles for France s Pressurised Water Reactors 55 The following functions must be performed in the event of SLB or FWLB: reactivity control, which is initiated by the automatic reactor trip and, where ne cessary, the injection of borated water by the SIS; residual-heat removal, which is provided by the unaffected steam generators, which are supplied with water by the EFWS until the EFWS tank is empty; for scenarios involving a large break inside the containment, heat is removed from the containment by the CSS. The most likely accident scenarios where FWLB leads to core melt involve either (i) several control rods becoming stuck outside the core and preventing reactivity control or (ii) failed closure of the isolation valves on the lines of the steam generator affected by the break (thus preventing the secondary loops from cooling the reactor) followed by failure of maintaining a feed-and-bleed stream (see Section ). With regard to SLBs, three scenarios leading to core melt can be mentioned as examples: a large break inside the containment followed by complete failure of the CSS. The pressure and temperature inside the containment could exceed the qualification range of the instrumentation used to operate the facility under accident conditions. Furthermore, loss of reactivity control might occur if at least two control rods are mechanically stuck outside the core; a small break followed by a control rod becoming stuck combined with failure, due to human error, to isolate the steam lines of the affected steam generator. In this case, reactivity control might not be provided; reactor trip followed by failure of the EFWS followed by a human error involving the injection of water into the RCS (no feed and bleed) Steam generator tube rupture accidents (SGTR) These accidents range from major leaks to complete ruptures of one or more steam generator tubes (SGTR category) and secondary-line breaks (water or steam) resulting in virtually immediate rupture of one or more steam generator tubes (combination of SLB and SGTR). Leakages or ruptures on a steam generator tube will induce a drop in the RCS pressure, an automatic reactor trip and actuation of the SIS and steam generator auxiliary feedwater systems. When this occurs, operating personnel must identify and isolate the affected steam generator, shut down the SIS and cool the RCS via the unaffected steam generators to establish the operating conditions required to actuate the RHRS. If too much time elapses before the affected steam generator is isolated or the SIS is turned off, the steam generator fills up with water. This water may block open the discharge devices on the corresponding secondary loop (steam-dump valves and safety valves), thus allowing

6 56 Nuclear Power Reactor Core Melt Accidents coolant to leak outside the containment. If this occurs, the RCS must be depressurised to stop the leak. SGTR (one tube or two tubes) accident scenarios that may lead to core melt include total loss of coolant from the secondary loop and failure of the SIS or implementation of feed and bleed by operators Accidents with total loss of heat sink or associated systems (H1) These accidents involve either loss of the heat sink (unavailability of cooling water pumped in from a river or sea) at all the site s units and directly leading to loss of the cooling systems (particularly that of the ESWS) or failure of the cooling systems used to remove heat via the heat sink (particularly loss of the ESWS, the CCWS or the RHRS). Loss of heat sink initiates a reactor trip; the RCS is cooled by the secondary loops, which are fed by the EFWS. However, the EFWS tanks are not limitless. If the heat sink is not restored after a certain time, cooling by the secondary loops will no longer be possible. Loss of the CCWS leads to: shutdown of the RCS pumps; shutdown of cooling of the thermal barriers of the RCPs. This may lead to an RCS break in the event of failure of the flow of injection water to the RCPs; failure of cooling of the water released from the CVCS; failure of cooling of some ventilation systems, which may lead to equipment failures (e.g., some pumps); eventually, failure of containment cooling during operation of the SIS and the spray system during recirculation of the water in the containment sumps. The rise in the temperature of the water in the sumps may cause the recirculation pumps to fail. In such an accident, intervention is required to bring the reactor back to a state where the flow of water to the RCP seals can be stopped without risk of damage to the seals (RCS pressure of no more than 45 bar and reactor-coolant temperature of no more than 190 C). The RCPs are shut off and the RCS is cooled by the secondary loops with natural circulation through the RCS. Core melt in a reactor at power may be caused by failure of the EFWS to supply the steam generators followed by failure to initiate feed and bleed or failure to maintain a sufficient amount of water in the RCS in the event of a break on the RCP seals. In the case of the various reactor shutdown states and depending on the initial reactor state, core melt may be caused by failure of the EFWS, failure to maintain a sufficient amount of water in the RCS during the closed and partially open states of the reactor, or even failure of the makeup water when the RCS is initially open.

7 Safety Principles for France s Pressurised Water Reactors Accidents with total loss of the steam generator feedwater supply (TGTA-H2) These accidents are caused by equipment failures that lead to simultaneous unavailability of the MFWS and the EFWS. In these accidents, the secondary sides of the steam generators are quickly voided and lose their efficiency. The RCS heats up and its pressure rises to the set pressure of the pressuriser safety valves. The RCS empties and remains at high pressure until core uncovery and melt occur. Core melt can thus occur while the RCS is pressurised. This poses a short-term threat for containment of the radioactivity released during core melt (ejection of corium into the containment during pressure-induced rupture of the vessel, resulting in direct heating of the containment (see Section 5.2.1), steam generator tube breaks). To avert high-pressure core melt, reactor operators must: open the pressuriser safety valves (SEBIM valves) and actuate the SIS (feed-andbleed operation) to cool the core; ultimately, restore the feedwater supply to the steam generators so as to establish the operating conditions allowing operation of the RHRS. The accident scenarios most likely to lead to core melt assume here failure of feed and bleed in either the short term (failure of the SIS to actuate or operator error) or in the longer term (failure of the SIS to operate, failure of the CSS to cool the containment) Accidents with station blackout (SBO H3) These accidents are initiated by the quasi-simultaneous failure of the two 6.6 kv emergency switchboards (LHA and LHB) or loss of offsite then onsite power due to a series of events damaging to the power sources and which in turn trips the reactor and cuts off power to the reactor s engineered safety systems. If the RCS is closed when such an accident occurs, operators must attempt to bring the reactor back to a state where injection of water to the RCP seals is no longer necessary. They must do this using the turbine generator (LLS), the test pump (injection to the RCP seals), the TDAFWP (turbine-driven auxiliary feedwater pump) and the steamdump valves. This state is characterised by an RCS temperature of no more than 190 C and an RCS pressure of no more than 45 bar. If the RCS is partially open when such an accident occurs, operators must attempt to bring the reactor back to an intermediate state where the RCS temperature is no more than 190 C and the RCS pressure is no more than 45 bar. The test pump compensates for the water lost through the RCS vents. If the RCS is open when such an accident occurs, a gravity-fed water-makeup system must be implemented as a short-term measure. This system is to be supplemented in the medium term by water injection by the adjacent unit s charging pump (900 MWe series) or the petrol water pump (1300 MWe and N4 series).

8 58 Nuclear Power Reactor Core Melt Accidents In all cases of SBO, the SBO generator (900 MWe series) or the combustion turbine (1300 MWe and N4 series) must be connected very quickly so that the systems enabling the reactor to return to a safe state may be restored to service. The accident scenarios that may result in core melt include: failure of the TDAFWP (900 MWe series), the TDAFWPs (1300 MWe and N4 series) or injection of water to the RCP seals (which could lead to a break due to the loss of cooling) when the RCS is initially closed; failure of the RCS makeup when the RCS is open Loss of onsite power The accidents discussed here are caused by loss of voltage on one or more low-voltage switchboards. In some cases, this loss of voltage may lead to partial unavailability of the feedwater supply to the steam generators and of the injection of water to the RCP seals. The accident scenarios that may lead to core melt therefore are primarily TGTA-H2 scenarios (total loss of the steam generator feedwater supply and failure of feed and bleed) and scenarios that lead to breaks on the RCP seals and failure to maintain a sufficient amount of water in the RCS Transients involving automatic shutdown failure (ATWS) The corresponding scenarios are caused by failure of the reactor to automatically trip upon insertion of the control rods following an internal initiating event that should result in an automatic trip. These transients lead to loss of the MFWS and the EFWS is unable to remove the heat generated by the reactor core. There may be three consequences: loss of integrity of the RCS when its design-basis pressure is exceeded; core damage (especially in the event of failure of cooling by the secondary side of the steam generators followed by failure of core cooling by feed and bleed); rupture of the steam generator tubes caused by the large difference in pressure between the primary and secondary loops RCS transients The corresponding scenarios encompass RCS transients caused in particular by ina dvertent operation of the SIS, uniform dilution (gradual drop in the boron concentration in the reactor coolant), non-uniform dilution (formation in the RCS of a water slug with low boron concentration that is subsequently injected into the reactor core), CVCS failure or uncontrolled rod withdrawal. These scenarios may lead to fuel degradation at each of the reactor s operational states.

9 Safety Principles for France s Pressurised Water Reactors 59 In the levels 1 PSAs (both those of EDF and IRSN), the frequency of core melt due to uniform dilution is low compared to that of non-uniform dilutions. Based on studies to date of the potential consequences of non-uniform dilution, it is not possible to assess the risks of failure of containment integrity. For this reason, both EDF s and IRSN s level 2 PSAs use a simplifying assumption, i.e., short-term failure of containment integrity. As a result, in these level 2 PSAs, non-uniform dilution contributes significantly to the risk of large early releases. Licensees must therefore aim to practically eliminate the corresponding scenarios Melt frequencies by scenario type determined by the level 1 PSA for the 900 MWe reactors As mentioned earlier, the level 1 PSA developed by EDF is the reference assessment. It results in a core melt frequency of around 4.6 x 10 6 per year and per reactor for all the scenarios described in Section After completing its level 1 PSA, following an update to take into account changes planned during the third ten-yearly outages (VD3) for the 900 MWe reactors, IRSN estimated core melt frequency 2 to be around 7.5 x 10 6 per year and per reactor for all reactor operational states. The contributions of the various types of scenario described in Section are shown in Table 4.1. Table 4.1. Distribution, by scenario type, of core melt frequency according to the findings of IRSN s post-vd3 level 1 PSA for the CPY 900 MWe series. 3 Scenario type IRSN (post-vd3 update) Core melt frequency (per year/reactor) % of total core melt frequency Loss-of-coolant accidents (LOCA) 1.2x % Loss-of-coolant accidents occurring with containment bypass (V-LOCA) 2.2x % Steam line break accidents (FWLB, SLB) 5x % Steam generator tube rupture accidents (SGTR) 1.1x % Total loss of heat sink or associated systems (H1) 1.3x % Total loss of the steam generator feedwater supply (TGTA-H2) 1x % Station blackout (H3) 2.9x % Loss of onsite power (PDS) 5.1x % Transients involving automatic shutdown failure (ATWS) 3.3x % RCS transients 3 3x % Total core melt frequency 7.5x % 2. As indicated above, the term core melt encompasses situations leading to simple cladding failure as well as situations leading to total meltdown of the fuel in the reactor vessel. 3. At the time of publication of this document, non-uniform dilution (which numbers among the accidents that can occur on the RCS) was undergoing a thorough review by IRSN in order to assess the new provisions proposed by EDF to prevent this type of accident.

10 60 Nuclear Power Reactor Core Melt Accidents The findings of EDF and IRSN s assessments show that the predominant scenarios are those caused by SBO Accident progression beyond core melt The previous sections present the wide variety of scenarios liable to lead to core damage. However, it should be noted that although these scenarios can be triggered by different initiating events, they may lead to similar developments after core melt. Indeed, understanding some of the characteristics of the state of the reactor at the time of core uncovery is sufficient to determine the subsequent evolution of the accident. These characteristics are used particularly in the interface between the level 1 PSAs and the level 2 PSAs, which will be discussed in Section 4.4. Examples of these characteristics include: the point at which the core melt accident occurs, as this determines the amount of residual heat in the core and thus the rate of progression of the accident; the pressure in the RCS during the core melt accident: particularly accidents where failure of the RHRS leads to high-pressure core melt situations, which lead to specific risks of damage to the containment; the state of the engineered safety systems, especially the availability of the CSS, which removes heat from the containment and removes airborne radioactive substances from the containment atmosphere; core subcriticality; the state of the containment, particularly its isolation or the presence of a bypass (loss of coolant through a break outside the containment) or even failed closure of the equipment hatch. The similarities in the expected progression of the various core melt accidents make it possible to generically assess the various phenomena that may come into play during these accidents. These phenomena are presented in Section General progression of core melt accidents and their management at reactors in operation in France and for EPR Physics of core melt and associated phenomena Core uncovery Start of core uncovery Core uncovery begins when the fuel rods are no longer completely covered by coolant due to a loss of coolant in the reactor core. Depending on the initial state of the reactor,

11 Safety Principles for France s Pressurised Water Reactors 61 the initiating event of the accident, system failures and any operating errors, core uncovery can be reached within a matter of minutes, hours or days of the initiating event. Core uncovery leads to core melt only if a sufficient level of cooling cannot be restored. For example, a 10 cm break in the RCS would, if water is not injected into the RCS by the SIS, lead to complete uncovery of the fuel rods in 30 minutes. Core uncovery with a pressurised RCS The progression and consequences of the accident will vary depending on the pressure in the vessel at the time of uncovery and vessel breach (as will be seen in subsections and 5.2.1). In practice, a high-pressure core melt accident occurs when the vessel pressure is greater than approx bar (order of magnitude) at the time of breach. A high-pressure core melt accident can occur in the following cases in particular: failure of the secondary side of the steam generators to cool the RCS; delayed core reflooding that causes the RCS pressure to rise to above bar just before the vessel lower head is breached In-vessel fuel degradation (failure of the first containment barrier) The physical phenomena involved in the progression of in-vessel accidents are discussed in Section 5.1. Section explains core degradation in detail. Section deals entirely with the behaviour of molten materials in the vessel lower head before is breached. This section describes the steps involved in in-vessel fuel degradation. Oxidation and failure of fuel-rod cladding As the water level drops in the reactor core, the uncovered part heats up under the action of the residual heat. At normal operation, the Zircaloy cladding surrounding the core fuel is at a maximum temperature of 350 C. At temperatures of C, the cladding becomes deformed due to the degradation of its mechanical properties. During the accident, the pressure in the vessel may or may not be greater than the pressure of the gases 4 in the fuel rods: if the pressure in the vessel is lower than the pressure of the gases in the fuel rods, the heat causes the cladding to swell until it bursts (Figure 4.1); 4. These are inert fill gases introduced into the rods during manufacture, and noble gases (particularly xenon and krypton) produced by the nuclear fission reactions that occur in the fuel pellets inside the rods. The pressure of these gases depends on the fuel irradiation time. For example, it can vary between 80 and 140 bar for a 1300 MWe PWR.

12 62 Nuclear Power Reactor Core Melt Accidents Figure 4.1. Degradation mechanisms of fuel cladding during severe accidents, at low pressure (gap: the space between the fuel pellet and the cladding which is filled with gas). Figure 4.2. Degradation mechanisms of fuel cladding during severe accidents, at high pressure (gap: the space between the fuel pellets and the cladding which is filled with gas).

13 Safety Principles for France s Pressurised Water Reactors 63 if the pressure in the vessel is higher than the pressure of the gases in the fuel rods, the heat causes the cladding to push against the fuel pellets, promoting formation of uranium dioxide zirconium (UO 2 -Zr) eutectic with a melting point of C (Figure 4.2). Hydrogen release and melting of the core materials During fuel uncovery and degradation, the zirconium in the fuel-rod cladding oxidises on contact with the superheated steam 5. The oxidation reaction starts at around 1200 C and accelerates considerably 6 at around 1500 C. However: oxidation is a highly exothermic chemical reaction. It locally releases heat that is more than the residual heat. If cooling is unable to remove this heat, both the temperature of the materials and the oxidation rate rise. This phenomenon is known as reaction runaway ; the reaction releases hydrogen 7 into the RCS. This hydrogen is carried all the way to the containment. If this hydrogen ignites inside the containment, it can cause a deflagration that, under certain conditions, leads to a detonation (the hydrogen risk in the containment is discussed in detail in Section 5.2.2); the cladding is embrittled and more vulnerable to thermal shock. Furthermore, the rate at which fission products are released increases with the increase in the temperature of the fuel pellets. Schematically: between 900 and 1800 C, the metal components of the core either melt or vaporise (control-rod components, structural steel, non-oxidised Zircaloy in the cladding); above 1800 C, the other core components (oxides, etc.) begin to melt. Figure 4.3 shows schematically the main phenomena involved in degradation of core materials. Temperatures of the order of 2800 C are required before the uranium oxide will begin melting. However, the presence of eutectic mixtures with the zirconium and steel of the control rods may cause molten materials to melt and relocate at lower 5. According to the reaction Zr + 2 H 2 O ZrO H 2, with a DH of 600 to 700 kj/mole of Zr and kg of H 2 produced per kg of oxidised Zr. 6. At 1500 C, a cubic ZrO 2 phase appears in the oxidised cladding, in equilibrium with a tetragonal ZrO 2 phase, which is stable at temperatures below 1500 C. As the oxygen diffusion coefficient is higher in the cubic ZrO 2 phase than in the tetragonal phase, the oxidation rate of the Zr speeds up very quickly. 7. Complete oxidation of 1 kg of Zircaloy produces around 0.5 m 3 of hydrogen at normal temperature and pressure. Given the quantities of zirconium in the cores of the PWR units, this amounts to the production of around 1 kg of hydrogen per MWe.

14 64 Nuclear Power Reactor Core Melt Accidents Figure 4.3. Main phenomena involved in reactor-core degradation. temperatures. This melting causes a local then general collapse of the reactor core and the formation of corium, a molten mixture of fuel and the materials of the structures that support the fuel in the vessel during normal reactor operation. This mixture is kept molten by the residual heat from radioactive decay of the fission products trapped in the corium. At these temperatures, the most volatile fission products almost entirely escaped from the fuel (Section ) RCS failure during a core melt accident (failure of the second containment barrier) Vessel-lower head failure The lower head of the vessel may be breached within a matter of tens of minutes or hours following collapse of the component elements of the core. This interval depends on the corium mass in the vessel lower head, the heat released by this mass and the presence or absence of water to remove part of this heat through evaporation. Vessel failure is discussed in Section

15 Safety Principles for France s Pressurised Water Reactors 65 Induced steam generator tube rupture During fuel degradation, the hot steam exiting the reactor core and circulating by natural convection through the RCS causes the RCS structures to heat up excessively. If the RCS is pressurised during in-vessel core melt, these structure may yield and break. Induced rupture of the steam generator tubes would cause fission products to be released directly to the outside atmosphere via the safety valves on the secondary loops (for example, the safety valves on the 900 MWe units are set at 76 bar). The phenomenology associated with high-pressure core melt accidents is discussed in Section Phenomena that can cause early failure of the containment during a core melt accident (failure of the third containment barrier) Direct heating of gases in the containment If the RCS is pressurised when the vessel is breached, corium may disperse into the containment as it flows out of the vessel and cause a sharp rise in pressure as the heat contained in the molten corium is rapidly transferred to the gases in the containment atmosphere. This phenomenon is known as direct containment heating and is discussed in detail in Section Hydrogen risk Hydrogen risk is the possibility of loss of containment leak tightness and integrity during hydrogen ignition. Hydrogen is mainly produced by oxidation of the zirconium in the cladding and of structures of the fuel elements during core degradation and by oxidation of the metals in the corium during the MCCI phase (Section ). This hydrogen builds up inside the containment and can locally reach high concentrations that exceed the flammability threshold in the H 2 + O 2 + H 2 O gas mixture. The hydrogen risk is discussed in detail in Section Steam explosion The corium produced during a core melt accident may come into contact with water if it is present in the vessel lower head (if the molten corium relocates here) or in the reactor pit (if the vessel lower head is breached). As the corium is at a much higher temperature than the water, this contact can trigger a very energetic interaction. On contact with the water, the corium may be highly fragmented and cause massive, instantaneous vaporisation of the water. Known as a steam explosion, this phenomenon is discussed in detail in Section

16 66 Nuclear Power Reactor Core Melt Accidents Phenomena that can ultimately lead to failure of containment integrity after a core melt accident On contact with the corium, the concrete of the containment s basemat in the reactor pit begins to decompose under the effect of the heat emitted by the corium. Known as the molten core-concrete interaction or MCCI, this phenomenon leads to the production of a large amount of gases that causes the pressure inside the containment to progressively rise. It is discussed in detail in Section Release of fission products When cladding failure occurs, the fission gases (krypton [Kr], xenon [Xe]) and other volatile fission products (mostly iodine [I], caesium [Cs], bromine [Br], rubidium [Rb], tellurium [Te] and antimony [Sb]) that have accumulated in the free volumes inside the fuel rods during operation of the reactor are released into the RCS. The same also occurs for a small portion of fission products in the fuel pellets. The volatile fission products initially present in the fuel pellets are then progressively released as degradation of the in-core fuel propagates. Nearly all the volatile fission products will have escaped from the fuel by the time it starts melting. The various phases of release of fission products are described more in detail in Section Releases to the environment depend on physical and chemical conditions that affect the transfer of fission products in the facility from the reactor vessel to the containment. These transfers are determined primarily by the type of fission products (gas or aerosol) and their chemical form. The mass of aerosols (fission products, heavy nuclei, materials of the structures and control rods) released into the containment during fuel degradation may be high (e.g., around 1500 kg for a 900 MWe PWR). These aerosols agglomerate and sediment. This results in reduction factors for the aerosol mass suspended in the containment atmosphere of between 300 (around 24 hours after the last releases) and 2500 (48 hours after the last releases). However, these values do not take into account aerosols that may be resuspended by, for example, dynamic phenomena inside the containment. Special attention is focused on the behaviour of iodine given its complexity and the potential short-term radiological consequences of releases of radioactive iodine to the environment. The main physical and chemical forms of iodine that can be found in the containment after a core melt accident are gaseous molecular iodine (I 2 ), particulate iodine (i.e., in aerosol form, such as caesium iodide [CsI]) and gaseous organic iodine (e.g., methyl iodide [CH 3 I]). Among these three physical and chemical forms, organic iodine is the hardest for existing filtration systems to trap. Very broadly speaking, during fuel-rod degradation iodine is released in the form of particles and gas into the RCS and then the containment.

17 Safety Principles for France s Pressurised Water Reactors 67 In the containment, the gaseous molecular iodine: is rapidly adsorbed by the paint on the walls of the containment and reacts with this paint or the organic compounds emitted by it to create gaseous organic iodine. This organic iodine may be converted by radiation into iodine oxides, which are comparable to very fine aerosols; mixes with the water in the containment sumps if the CSS is actuated; is released outside the containment by direct or filtered leaks. The iodine aerosols are deposited on the relatively cool walls and floors of the containment and, for example, are entrained to the containment sumps by the condensed water vapour. Depending on the physical and chemical conditions in the sumps and under the effect of the radioactivity, the iodine aerosols may enter into complex chemical reactions, the net effect of which is the production of gaseous molecular iodine that escapes into the containment atmosphere. The noble gases (Xe, Kr) and the gaseous organic iodine are not deposited but instead released outside the containment by direct or indirect leak paths. Releases, transfers and the chemistry of fission products are discussed in more detail in Section Containment failure modes The Rasmussen report Background At the request of the US Nuclear Regulatory Commission, Professor Norman C. Rasmussen of the Massachusetts Institute of Technology (MIT), conducted from 1972 to 1975 a scientific investigation into hazards created by the use of nuclear-power reactors (pressurised water reactors and boiling water reactors). This overall survey gave a systematic analysis of possible accident scenarios. The report s general conclusions were given as graphs showing the relationship between accident probabilities and expected numbers of cancer fatalities. Published in 1975 under reference numbers WASH-1400 and NUREG , the Rasmussen report [1] is the first example of a comprehensive probabilistic safety assessment (PSA) giving figures for the probable impact on the population (level 3 PSA). Despite the considerable uncertainties of the probabilities and consequences, French and international safety authorities tried to draw practical conclusions from this study to improve the safety of power reactors and intervention by public authorities in the event of an accident. The Three Mile Island accident of 1979 (Section 7.1) fuelled discussions on these subjects.

18 68 Nuclear Power Reactor Core Melt Accidents Classification of the possible containment failure modes Rasmussen s classification of the possible containment failure modes is still in use today. The five main modes are shown in Figure 4.4: mode α: steam explosion in the vessel or reactor pit caused by an interaction between the corium and the coolant, inducing loss of containment integrity in the short term; mode β: initial or fast-induced loss of containment integrity; mode γ: hydrogen explosion in the containment, inducing loss of its integrity; mode δ: slow overpressurisation of the containment, inducing loss of its integrity; mode ε: basemat melt-through by the corium, inducing basemat breach. Mode V, which corresponds to bypasses of the containment by outgoing pipes, is dealt with separately, since it does not directly concern the behaviour of the containment building. Spray Water δ Containment γ Stack Heat exchanger CO 2 CO H 2 O H 2 Fission α products Auxiliary buildings Filter Sumps β Ventilation ε Drains Figure 4.4. Schematic diagram of the possible containment failure modes according to the Rasmussen report [1].

19 Safety Principles for France s Pressurised Water Reactors Other failure modes The possibility of loss of containment integrity by direct containment heating was identified in the early 1980s in the USA after the publication of the Rasmussen report. Discussions held between 1987 and 1990 after the Chernobyl accident (Section 7.2) led to the identification of high-frequency accidents that can lead to significant reactivity insertion into reactor cores. Reactivity insertion is followed by a sudden and significant increase in the nuclear-power output of the reactor core and can trigger an explosion that would damage both the vessel and the containment. Given its crucial importance for the consequences of a core melt accident, containment behaviour and its failure modes are the subject of many studies (Section ). Chapter 6 of this document is devoted entirely to them Management of core melt accidents at PWRs in operation in France Introduction The resumption of core cooling and the preservation of the integrity of both the vessel and the containment resulted in very little radioactive material being released to the environment during the core melt accident at TMI-2 (Section 7.1). Yet, for several days the plant s management as well as local and federal US authorities wondered how the accident would progress and if it could lead the reactor to explode or the containment to fail and release significant amounts of radioactivity to the environment. The contradictory information given by the authorities, which were unable to assess the severity of the accident, spread panic throughout the populations within the vicinity of the nuclear-power plant. Nearly 200,000 people fled the area. Although its radiological consequences remained very limited, the accident prompted a major national crisis. It became apparent that it was vital to devise provisions and means for managing core melt accidents in a less improvised manner. A twofold approach was adopted: (i) implement short-term provisions and means to better prevent core melt accidents and mitigate their consequences and (ii) expand research to improve knowledge of the physics of this type of accident. The provisions and means put in place included implementing specific procedures and a new operating organisation (see Section 2.5.2), improving the integration of operating experience feedback and the development of simulation tools and resources for managing emergencies. It therefore quickly became apparent that if the authorities were to be able to take the most appropriate and timely decisions to ensure the protection of people and the environment, it was vital to have a deeper understanding of the behaviour of containments, even under conditions far removed from those considered for their design, and the implementation of tools for simulating the potential developments of an accident, the corresponding releases and their transfer to the environment.

20 70 Nuclear Power Reactor Core Melt Accidents Studies were therefore conducted to: investigate the possible containment failure modes (presented in the previous section) and assess the resources required to address them under the best possible conditions. This type of study subsequently went hand in hand, both at EDF and IRSN, with the development of level 1 and level 2 probabilistic safety assessments (Section 4.2 and Section 4.4); determine the environmental releases corresponding to different core melt baseline accidents (Section ). EDF used the lessons learnt from this work to draft severe-accident operating guidelines (GIAG) (Section ). These guides define the specific actions to be taken during severe accidents in order to ensure, for as long as possible, the best possible containment of radioactive substances. The French public authorities plan to implement measures to protect populations near nuclear sites (Section ) in addition to the general measures enacted as part of the ORSEC-RAD plan. The main provisions taken in France to manage core melt accidents in operating reactors are described in the following sections and are summarised in Figure Classification of releases associated with core melt accidents Definition IRSN has determined specific types of releases, known as source terms. A source term is a specific type of release characteristic of a family of reactors and representative of a type of accident, i.e., in general a containment failure mode following complete core melt. The source term is taken into consideration when defining corrective actions to be taken to protect people under these conditions. Three source terms, listed in decreasing order of severity, were defined in 1979: source term S1 corresponds to short-term containment failure occurring no more than a few hours after the onset of the accident; source term S2 corresponds to direct releases to the atmosphere following loss of containment integrity occurring one or more days after the onset of the accident; source term S3 corresponds to indirect, delayed releases to the atmosphere through pathways allowing a significant amount of fission products to be retained. Table 4.2 lists the orders of magnitude for these source terms for a 900 MWe reactor. Broadly speaking, the primary aim of the research conducted on severe accidents to improve the safety of facilities was to eliminate, via adequate provisions and means, accidents liable to lead to S1 and S2 releases. IRSN and EDF are currently conducting research to mitigate the consequences of accidents regardless of their severity in addition to eliminating the most severe accidents.

21 Safety Principles for France s Pressurised Water Reactors 71 Table 4.2. Source terms S1, S2 and S3 for a 900 MWe PWR expressed as percentages of the initial activity of the radioactive substances present in the reactor core. Source term S1 S2 S3 Noble gases Inorganic iodine Organic iodine Caesium Tellurium Strontium Ruthenium Lanthanides and actinides < Radiological consequences The initial S3 source term comes from the now-dated investigation of an accident scenario in the Rasmussen report [1] that was adapted to French reactors. It was partially updated in the late 1980s after emergency procedures were put in place in French reactors. One procedure of note is the U5 procedure, which is associated with a system for decreasing the pressure inside the containment in the event of an accident (venting line with a sand filter that was subsequently retrofitted with a metal prefilter placed in the containment). Since then, the baseline S3 source term is represented for studies by a delayed release filtered through the sand-bed filter. The release is assumed to spread somewhere between 24 hours and 48 hours after the onset of the accident. This source term is now periodically reassessed to take account of improved understanding of the behaviour of fission products. The S3 source term was used in the 1970s to establish the technical foundations of offsite emergency plans (PPI), which are implemented to ensure short-term protection of people from environmental releases. The S3 source term is assessed for accident scenarios chosen for being reasonably conservative in terms of releases to the environment and offsite radiological consequences. The doses received by people for an S3 release are estimated using the dose coefficient values established by key international organisations (defined in the publications of the International Commission on Radiological Protection [ICRP] [2]). These estimated doses are used to determine whether measures implemented as part of offsite emergency plans (evacuation, sheltering) to ensure short-term protection of people are sa tisfactory for S3 releases. The radiological consequences for the environment depend primarily on short-term releases of iodine and longer-term releases of caesium (Section 5.5.1). In practical terms,

22 72 Nuclear Power Reactor Core Melt Accidents iodine releases govern short-term management of the accident while caesium releases govern medium- and long-term management of the accident. Improvement of understanding Since the Three Mile Island accident, many experimental results have been obtained around the world regarding the phenomena associated with core melt accidents (see all of Chapter 5). France (in particular IRSN) played a major role in obtaining these results, particularly through the Phebus-FP programme, which was conducted at the Cadarache nuclear research centre (Section 7.3). Knowledge and understanding of the complex phenomena involved in such accidents have grown considerably. Likewise, abilities to predict changes in reactor-core state with the help of simulation tools have been significantly improved (see Section 7.1.4). Nevertheless, new experimental data on issues such as the behaviour of iodine and ruthenium inside the RCS and containment, the interaction between corium and concrete of containment basemats and in-vessel reflooding of damaged cores during core melt accidents are expected to be obtained in the coming five years. International research programmes conducted to improve knowledge of the progression of core melt accidents and the associated releases are presented in Chapter Investigation of the possible containment failure modes Introduction While the source terms were being defined, studies being conducted in France following the publication of the Rasmussen report looked at the various possible modes of containment failure at France's nuclear-power plants as well as the ways to strengthen this last barrier to release. These studies were conducted with realism in mind. The aim was not to perform a safety demonstration using conservative assumptions but rather to pragmatically find ways to improve facilities having a set basic design and define procedures for protecting the population under the best possible conditions. A number of these improvements and procedures called for implementing additional equipment. It was thus in the wake of the TMI-2 accident that ultimate procedures (U procedures) and associated provisions designed to avoid or mitigate the radiological consequences of core melt accidents were progressively introduced at all units in France's nuclear-power-plant fleet (Section 2.5.2). The Severe-Accident Operating Guideline (GIAG) defines the specific measures to be taken and, where imposed by the progression of an accident, implementation of ultimate procedures designed to ensure the best containment of radioactive substances for the longest possible time. Figure 4.5 summarises the main provisions taken in France to manage core melt accidents in operating reactors.

23 Safety Principles for France s Pressurised Water Reactors 73 Initial containment failure During normal operation, containment integrity is continuously monitored by a system that is based on pressure measurements and is able to detect a large leak (open pe netration or hatch). The isolation devices of the containment penetrations are periodically and individually inspected to ensure their integrity. Lastly, pressurising the containment (before the reactor is loaded for the first time then once every 10 years) makes it possible to compare the overall leakage rate of the containment with the technical requirements. All these inspections, which are presented in detail in Chapter 6, are carried out to assess containment leakage and prevent large leaks from forming when an accident occurs. It should be noted that direct leaks (uncollected leaks, discharged directly to the environment) are particularly important on account of their radiological consequences. During an accident, direct leaks can occur if automatic isolation of containment pe netrations fails or if the integrity of the containment hatches is lost. This mode of containment failure (referred to as mode β) is very important as it can allow radioactivity to be released directly to the environment from virtually the very start of an accident. Ensuring satisfactory protection of nearby populations would be impossible under such circumstances. To cope with this, EDF developed the U2 procedure entitled What to do in the event of loss of containment integrity. It defines the methods for monitoring containment integrity during accident situations (even non-severe accidents) once radioactivity rises to a specific threshold and for detecting and localising integrity breaches in order to correct them wherever possible. It supplements continuous monitoring of the containment leakage rate during normal operation, which only makes it possible to detect very large leaks. The U2 procedure encompasses: conditions for containment monitoring by measuring the activity released by the stack and the activity in the containment sumps, the peripheral rooms and their ventilation systems; and by checking the states of the isolation devices; the actions to be taken, such as confirming isolation orders; localising leaks and implementing means to eliminate them; containment of rooms or, where the situation is under control and allows some containment penetrations to be reopened, reinjection into the reactor building of liquid waste collected in the peripheral buildings. Direct containment heating The main risk associated with this phenomenon, which would be caused by corium breaching the vessel under pressure, is loss of containment integrity due to a rapid rise in the containment pressure. This rise in pressure is associated with corium fragmentation and diffusion of corium particles in the containment atmosphere, which cause the gases in the containment to heat up and may lead to combustion of the hydrogen there.

24 74 Nuclear Power Reactor Core Melt Accidents Direct containment heating is prevented by reducing the possibility of highpressure core melt. This ultimately involves intentionally reducing the pressure in the RCS so that the pressure in the vessel is below 15 or 20 bar (order of magnitude) when it is breached. Direct containment heating is presented in detail in Section Hydrogen explosion in the containment Combustion of all the hydrogen produced by oxidation of the Zircaloy cladding in the active part of the core (amounting to 80% of the total mass of Zr in the core) would produce a pressure pulse that could affect the containment integrity of French PWRs. Faced with this risk of loss of containment integrity from hydrogen combustion, in 2001 ASN asked EDF to install passive autocatalytic hydrogen recombiners in all the reactors of France's fleet. EDF complied with ASN's request. This decision took into account neighbouring countries' decisions (e.g., Belgium, Switzerland and Germany) to install hydrogen recombiners. The production and combustion of hydrogen as well as the associated risks (a hydrogen explosion in a containment can lead to loss of containment integrity [mode γ]) and the operation of a passive autocatalytic hydrogen recombiner are described in Section Steam explosion in the vessel or reactor pit A steam explosion may occur when hot, fragmented corium comes into contact with water present in either the vessel lower head or, after vessel melt-through, the reactor pit (water from the CSS). The mechanical energy of a steam explosion in the vessel could cause the vessel to burst and generate missiles that could endanger the integrity of the containment and particularly the vessel head. Mode α, as defined in the Rasmussen report, corresponds to an in-vessel steam explosion that induces loss of vessel integrity and rips off the vessel head. Mechanical studies of in-vessel steam explosions conducted by several international experts have led to the conclusion that a direct loss of containment integrity induced by mode α is highly unlikely. However, vessel breach caused by an in-vessel steam explosion cannot be completely ruled out. The energy released by a steam explosion induced by a flow of corium into a flooded reactor pit could compromise the strength of the structures adjacent to the reactor pit (particularly the adjoining walls and floors) and the strength of the various components of the RCS and especially the containment. R&D investigations are still being conducted on reactor-pit steam explosions. These investigations aim to demonstrate that such explosions do not lead to loss of containment integrity.

25 Safety Principles for France s Pressurised Water Reactors 75 French operating units do not at present implement special procedures or provisions regarding the risk of containment failure in the event of steam explosions in a reactor vessel or flooded reactor pit. One possibility could be to limit the amount of water in reactor pits to reduce or even eliminate (if the pits can be kept dry) the risk of steam explosions occurring in them. However, it should be emphasised that a large amount of water in reactor pits would make it possible to cool part of the corium before it comes into contact with the concrete basemat of the containment and could delay erosion of the basemat by the corium and even, in some cases, prevent basemat melt-through. Managing the water in reactor pits in the event of a severe accident is the subject of supplementary studies incorporating the R&D results for steam explosions. Steam explosions are presented in detail in Section Slow rise in the containment pressure Mode δ corresponds to loss of containment integrity from overpressure due to heating of the containment atmosphere caused by insufficient removal of the heat generated by the fission products and to the progressive formation of a very large amount of gases during erosion of the basemat concrete by corium. Added to these gases may be steam from the water used to cool the corium in an attempt to slow its progress. If the containment atmosphere is not cooled, its internal pressure will rise inexorably and could lead to a loss of containment integrity after a period of 24 hours. In the face of the possibility of irreversible loss of containment integrity, it was found appropriate to have a means of controlling the pressure inside the containment by allowing filtered releases. The adopted solution consisted in using a containment penetration intended to vent pressure from the containment during its initial and subsequent periodic pressure tests. Known as filtered venting, this system consists of a set of valves, a relief valve and a sand-bed filter with a surface area of 42 m 2 and a thickness of 80 cm. The system is located outside the containment and sandwiched between the penetration and the stack. Filtered venting is used to: limit then reduce the pressure inside the containment; reduce the activity of the aerosols in the released gases by a factor of at least 10; direct the filtered gases to the stack, where their activity is measured. Tests of the filtration efficiency of such a sand bed and the optimisation of its geometry and the flow conditions through it were conducted in the early 1990s by IPSN in its research facilities in collaboration with EDF. These tests showed that it was possible to achieve, and even exceed, the minimum efficiency sought (i.e., a reduction factor of 10 for aerosols). The FUCHIA tests (at a filter scale of 1) showed that the filtration efficiency

26 76 Nuclear Power Reactor Core Melt Accidents of the filter sand was higher by one order of magnitude than the minimum efficiency sought for aerosols. Nonetheless, in the event of an accident, the build-up of radionuclides in the filter sand could have led to problems of onsite radiation protection and filter cooling. Furthermore, the rapid condensation of the water vapour in the pipes could have caused a hydrogen deflagration (the hydrogen/steam mixture from the containment was made explosive by the rapid decrease in the steam concentration). Various additional provisions were thus implemented. One measure consisted in the addition of a prefilter on the filtered venting system inside the containment to filter aerosols while another entailed the addition of a heater on the line outside the containment upstream of the sand-bed filter. The prefilter lowers the radioactivity levels in the sand-bed filter. The line heater prevents the condensation of steam. In the event of a core melt accident, the containment filtered venting procedure (known as U5) would be used only in close collaboration with the public authorities. The filtered venting system cannot be opened until at least 24 hours following the onset of an accident. This interval ensures that the system is used only when the concentrations of airborne radioactive substances inside the containment have sufficiently abated and allows time to implement appropriate measures to protect people (preventive evacuation, sheltering) from the releases that will be discharged to the environment by the filtered venting system. Melt-through of the containment concrete basemat by corium Mode ε corresponds to loss of containment integrity due to corium melt-through of the containment basemat. Basemat melt-through In the current state of nuclear facilities and according to current knowledge, corium can completely melt through the basemat within a period of time that depends on the characteristics of the basemat (concrete type 8, basemat thickness 9 ) but is always greater than 24 hours 10. The MCCI and the associated risks are presented in Section Siliceous concrete or silico-calcareous concrete. 9. The basemat thickness varies between 2.25 and 4.0 m depending on the series. It was initially only 1.5 m thick at the units at Fessenheim (see Section for more details), but was recently thickened by 50 cm. 10. In response to the conclusions of the safety review conducted during the Fessenheim plant s third ten-yearly outage, ASN asked EDF to implement provisions to increase the melt-through time in the event of a severe accident with vessel breach in Fessenheim units. EDF therefore increased the basemat thickness by 50 cm in the reactor pit and in an additional corium spreading area that was provisioned for corium spreading and cooling.

27 Safety Principles for France s Pressurised Water Reactors 77 U4 provisions The initial design of the basemats of EDF's nuclear-power plants includes a network of drain pipes and penetrations (particularly for the basemat monitoring systems). Construction measures were therefore taken to prevent direct contact of corium with the environment in the event of basemat erosion (filling with injected mortar or sealing with adequate metal plugs welded on the ends of pipes that had not initially been closed off). The units at the Cruas site posed a specific challenge. Each unit rests on a top basemat that is connected to a bottom basemat by anti-seismic bearings. The empty space between these basemats is connected to the outside air and, in the event of a core melt accident, could allow unfiltered releases to escape outdoors. This prompted EDF to establish specific provisions (known as U5 Cruas and U4 Cruas, respectively) to prevent such releases. These provisions entail: venting the pressure inside the containment until it equals that of the space between the basemats at the time of melt-through of the top basemat so that the contents of the containment atmosphere are not ejected into this space; completely flooding this space with water to reduce releases to the environment under the resulting effects of dilution, filtration and cooling, and adding sodium hydroxide to this water to obtain a basic solution that will dissolve the iodine in it. Bypass of the containment by outgoing pipes (mode V) Loss-of-coolant accidents with containment bypass (known as V-LOCA) occur when coolant is lost through a break outside the containment in a loop connected to, but not isolated from, the RCS. V-LOCAs have two specific characteristics: as coolant is lost outside the containment, the recirculation of water in the SIS is impossible; in the event of core melt, fission products would be released directly outside the containment if the break is not isolated in time. To prevent loss of containment integrity due to a V-LOCA, EDF implemented design and operation retrofits at all the reactors in France's fleet. In particular, these retrofits addressed the risk of containment bypass in the event of a break on the thermal barrier of a reactor-coolant pump and the portion of the affected CCWS. These retrofits are designed to practically eliminate V-LOCAs that might lead to significant short-term releases. Containment bypasses are discussed in Section 6.4. Rapid reactivity insertion accidents Cases of rapid reactivity insertion due to accidental injection of a water slug with a low boron concentration into the reactor core (these non-uniform dilution accidents may be caused by operator error, failure of the auxiliary systems or leaks on

28 78 Nuclear Power Reactor Core Melt Accidents steam generator tubes) are the subject of detailed studies that consist of the following three steps: definition of a maximum volume of a de-borated water slug for which core subcriticality is demonstrated, on the basis of neutronic and thermal-hydraulic codes related to core subcriticality independent of the dilution accident considered; definition of provisions designed to ensure that this maximum volume is not exceeded during each of the dilution accidents considered; performance of a probabilistic assessment to determine the adequacy of the provisions implemented Severe-Accident Operating Guideline (GIAG) The purpose of EDF's Severe-Accident Operating Guidelines (GIAG) is to provide emergency-response teams with the guidance needed to ensure that radioactive substances are contained as best as possible. The GIAG describes the possible actions and recommendations for mitigating the consequences of severe accidents. These actions and recommendations are the subject of discussions between EDF and IRSN's experts to take into account advances in the understanding of severe accidents. When the GIAG is implemented 11, the priority is placed on safeguarding the containment rather than the reactor core. When implemented, the GIAG overrides all other emergency operating procedures and responsibility for plant operation is transferred from the control-room operators to the emergency-response teams. The GIAG provides the emergency-response teams with the necessary guidance for defining the best system-usage strategies for safeguarding the containment. The control-room operators implement the operating actions requested by the local emergency-response team. During their third ten-yearly outages, specific instrumentation is installed in the 900 MWe reactors to allow emergency-response teams to better assess the progress of core melt accidents and better inform the authorities about these accidents (containment hydrogen monitoring; detection of corium on the basemat of the reactor pit) Radiological consequences of the S 3 source term and response plans of the public authorities In the early 1980s the French public authorities explored the realistic possibilities of implementing measures to protect people (sheltering, evacuation) near France's nuclear sites. Based on the characteristics of these sites, the French authorities estimated that evacuating people located within a 5-km radius of a site and sheltering people located within a 10-km radius of a site would be possible within hours 11. Main implementation criterion: the temperature of the gases exiting the core is greater than 1100 C.

29 Safety Principles for France s Pressurised Water Reactors 79 of the onset of an accident 12. They observed that implementing these measures would ensure a satisfactory level of short-term public protection against releases corresponding to the S3 source term, which at the time had been assessed in the light of the response levels recommended then by international organisations. When assessing radiological consequences, the S3 source term can be described as a release resulting from use of the containment filtered venting system to vent the containment 24 hours after the onset of an accident leading to core melt 13. The radiological consequences are calculated based on the weather conditions. The results are expressed in terms of effective doses from the radioactive plume (external and internal exposure), ground fallout, ingestion and equivalent doses to the thyroid (primarily due to iodine). The results are assessed in the light of the applicable publicsafety measures. The public-safety measures that can be implemented during the emergency phase are indicated in the offsite emergency plans (PPI). The prefect may consider a number of public-safety measures: sheltering; ingestion of potassium-iodide tablets: people who may be affected by releases of radioactive iodine ingest the prescribed dose of potassium iodide when the order is issued by the prefect; evacuation. The ICRP, first in publication 103 (2007) then in publication 109 (2009) [2] issued its recommendations for the protection of people in emergency exposure situations. The primary purpose of these recommendations is to contribute to ensuring an appropriate level of protection of the population and of the environment against the harmful effects of radiation exposure, including in emergency situations. By virtue of ASN decision 2009-DC-0153 of August 2009, sanctioned by the Order of 20 November 2009, the French public authorities set the response levels for radiological emergencies at: an effective dose of 10 msv for sheltering; an effective dose of 50 msv for evacuation; an equivalent dose to the thyroid of 50 msv for potassium-iodide administration. These levels are intended to guide the public authorities in taking public-safety measures in the event of an accident. For example, in the event of an accident with releases forecasted to result in effective doses of 10 msv throughout a 1-km radius, the French public authorities would shelter people located in a more than 1-km radius. 12. These distances have been adopted as the radii of action in the French authorities offsite emergency plans (PPI) for all EDF sites in France. 13. Such a release is assessed for early-release accidents with large RCS break and failure of the SIS and CSS.

30 80 Nuclear Power Reactor Core Melt Accidents For the S3 source term, IRSN estimated that the doses for the most radiosensitive individuals would remain below the response levels within a radius of up to 6 km for evacuation and up to 18 km for potassium-iodide administration for average 14 weather conditions and along the axis of the wind, assumed here to be constant. However, due to uncertainties in the understanding of the phenomena involved in core melt accidents and the dispersion phenomena of radioactive materials in the environment, it has not yet been deemed advisable to change the radii of the offsite emergency plans (PPI) for France's nuclear-power plants. Independent of its immediate radiological consequences, the Chernobyl accident (Section 7.2) highlighted the extent of long-term social and economic disruptions due in particular to contamination of food supply chains. Restrictions on the distribution of foodstuffs, set beforehand by the European Commission (maximum permitted levels [MPL] of radioactive contamination of foodstuffs), and which would be automatically enforced in the event of a new accident, are very low. In the case of releases corresponding to the S3 source term, distribution could be prohibited across distances far from the release site (more than 100 km) for periods of varying length depending on the radionuclides released. These observations prompted a search for ways to significantly reduce the maximum conceivable releases for Generation III reactors (see Section on EPRs) and to attempt to reduce, to the greatest possible extent, possible releases from operating reactors as part of a process of continual safety improvement. Following the interministerial directive of 7 April 2005 on the measures to be taken by the public authorities in case of an event leading to a radiological emergency, ASN set up a steering committee for management of the post-accident phase of nuclear accidents or radiological emergencies (CODIRPA). The committee's mandate is to develop the policy on organisation of the actions of the public authorities following an accident. The first policy elements arising from CODIRPA's work (to read a general summary of CODIRPA's work, see the 29 January 2008 report on ASN's website led to the proposal of taking immediate actions (where warranted) right from the end of the emergency phase for the short-term post-accident phase and the long-term post-accident phase to: limit the exposure of the population; reduce land contamination; prohibit the consumption and distribution of contaminated foodstuffs; manage contaminated food waste; monitor radiation levels in exposed populations. 14. Normal diffusion and wind velocity of 7 m/s.

31 Safety Principles for France s Pressurised Water Reactors 81 Accident progression Provisions for preventing accidents and mitigating their consequences Control Loss of core cooling Cladding oxidation Melt Vessel meltthrough Corium-water interaction Molten core concrete interactions (MCCI) H4-U3 procedures: mobile water-injection equipment (core engineered safety system) Catalytic recombiners for limiting the risks of an H2 explosion Containment monitoring provisions: U2 procedure (containment isolation) U4 measure (with specific actions for the Cruas plant) Provisions designed to avert high-pressure core melt and direct heating of the gases in the containment Improvement in reliable opening of the pressuriser valves Depressurisation of the RCS Water makeup operation strategy (SIS, accumulators, etc.) to cool the corium outside the vessel Emergency operating procedures Severe-Accident Operating Guideline (GIAG) Priority placed on safeguarding the containment Specific instrumentation for severe accidents (containment pressure, hydrogen content, detection of vessel melt-through) Severe-Accident Operating Guideline (GIAG) Radioactive releases U5 procedure: filtered venting Containment venting Filtration of releases ORSEC-PPI plan and ORSEC-RAD plan Figure 4.5. Main provisions taken in France to manage core melt accidents in operating PWRs Approach adopted for EPRs Ambitious safety targets have been set for France s EPR since These targets aim in particular at significantly reducing radioactive releases that may result from all conceivable accident situations, including accidents with core melt. These targets have led to implementation of the design provisions described on the following pages. The corium catcher, a new system engineered for EPRs, is an example of these provisions (Section ). Its operation will have to be specifically demonstrated taking account of the related uncertainties General safety targets The general EPR safety targets pertaining to severe accidents are specified in reference [4]. Accidents with core melt that may lead to large early releases (Section 4.3.2) must be practically eliminated. If they cannot be considered as physically impossible, design provisions must be taken to prevent them. This applies in particular to accidents with high-pressure core melt.

32 82 Nuclear Power Reactor Core Melt Accidents Accidents with low-pressure core melt must be managed such that the associated maximum conceivable releases only require public-safety measures that are very limited in terms of scope and duration. This may involve: no permanent relocation; no need for emergency evacuation beyond the immediate vicinity of the nuclear site; limited sheltering; no long-term restrictions on the consumption of foodstuffs. As regards accidents with low-pressure core melt, given the wide range of possible accident conditions, compliance with this target must be demonstrated by calculating the radiological consequences of various representative accidents that have been defined by taking account of the detailed design of the facility Practical elimination of accidents that could lead to large early releases Practical elimination of accidents that could lead to large early releases is a matter of judgement. Each type of situation must be considered separately. Practical elimination can be demonstrated by deterministic or probabilistic considerations, taking into account uncertainties due to limited understanding of certain physical phenomena. However, practical elimination cannot be demonstrated simply by compliance with a generic probabilistic cut-off value. Accidents with core melt that must be practically eliminated through design are as follows: high-pressure core melt accidents that could lead to direct containment heating or steam generator tube rupture; rapid reactivity insertion accidents, in particular those caused by rapid injection of insufficiently borated water in the reactor core; in-vessel and ex-vessel steam explosions and global hydrogen detonations that could endanger containment integrity; core melt accidents with containment bypass (via the steam generators or the loops connected to the RCS). Practical elimination of high-pressure core melt situations In order to avoid high-pressure vessel melt-through (pressure greater than an order of magnitude of bar) or a steam generator tube rupture, the top of the pressuriser of the EPR has three pressure relief valves and two other valves, that provide either feed-and-bleed or emergency blowdown of the RCS for severe accidents. The three pressure relief valves protect the RCS from overpressurisation. For the other valves, the

33 Safety Principles for France s Pressurised Water Reactors 83 Figure 4.6. EPR Emergency RCS blowdown system. feed-and-bleed mode is used in the event of total loss of the steam generator feedwater supply; the emergency RCS blowdown mode is used to prevent high-pressure core melt. Either valve may be used for feed-and-bleed operation and emergency blowdown of the RCS. The three pressure relief valves and the two feed-and-bleed/high-pressure melt valves discharge to the same letdown line, which carries the water, steam or water/ steam mixture to the pressuriser relief tank (PRT) (Figure 4.6). In addition, design provisions have been adopted to limit the diffusion of fragmented corium particles in the containment atmosphere in the event of vessel lower head meltthrough so as to avoid direct containment heating. These design provisions relate to the reactor pit and its ventilation system and are intended to prevent large amounts of corium exiting the reactor vessel from being carried from the reactor pit to the free volume of the containment. Practical elimination of rapid reactivity insertion accidents Practical elimination of rapid reactivity insertion accidents by injection of a water slug with low boron concentration into the reactor core requires a detailed investigation of the various possible dilution scenarios that takes into account all the lines of defence for each scenario. The investigation consists of the three steps discussed in Section

34 84 Nuclear Power Reactor Core Melt Accidents Practical elimination of the risk of steam explosion In order to prevent steam explosions in the event of high-temperature corium flows into the reactor pit, EPRs are designed with provisions for preventing water from entering the reactor pit before vessel breach occurs, even in the event of rupture of an RCS pipe. EPRs also feature design provisions that avert steam explosions by preventing water from entering the spreading compartment of the corium catcher before the corium reaches it. Practical elimination of the risk of hydrogen detonation The design-basis pressure and temperature of the inner containment wall must ensure the integrity and leak tightness of the containment even after a global deflagration of the maximum amount of hydrogen that may be in the containment during lowpressure core melt accidents. In addition, the volume of the containment and the mitigation means, such as the passive autocatalytic recombiners, must make it possible to reduce the hydrogen concentrations in the containment atmosphere to prevent the possibility of a global hydrogen detonation. Lastly, the design of the containment internals must prevent, as far as reasonably possible, the possibilities of high local hydrogen concentrations. If it is not possible to demonstrate that the local hydrogen concentration remains below 10%, the absence of deflagration-to-detonation transition (DDT) and fast deflagration must be demonstrated. Failing this, adequate provisions must be implemented, such as reinforcement of the walls of the corresponding compartments and of the containment Provisions for low-pressure core melt Design provisions have been adopted for low-pressure core melt accidents in order to comply with the aforementioned general safety targets. The main provisions are as follows: a corium catcher located at the bottom of the containment is used to retain and cool corium following vessel lower head melt-through (Figure 4.7). The corium catcher is designed to protect the containment basemat from MCCI. Corium is cooled in a spreading compartment. This compartment is separated from the reactor by a grid covered with a layer of sacrificial concrete and a discharge channel to protect it from thermomechanical loading caused by failure of the reactor vessel. Design provisions prevent water from any part of the containment from entering this compartment before the corium spreads along its surface. The reactor pit and spreading compartment are lined with layers of sacrificial concrete to obtain the adequate characteristics of the molten mixture. Once spread along the layer of sacrificial concrete in the spreading compartment, the surface

35 Safety Principles for France s Pressurised Water Reactors 85 (a) (b) Figure 4.7. EPR. Diagram of the corium catcher: (a) cutaway view; (b) top view with the spreading compartment in the foreground.

36 86 Nuclear Power Reactor Core Melt Accidents of the corium is cooled by flooding it with water from the IRWST. In addition, the thermal loads imposed on the basemat are limited by a thick steel plate that is located under the layer of sacrificial concrete and cooled by cooling channels connected to the CHRS (see below); the design-basis pressure and temperature of the inner containment wall make it possible to ensure containment integrity and leak tightness in the event of a severe accident: for at least 12 hours without removal of residual heat from the containment; after a global deflagration of the maximum amount of hydrogen that could be present in the containment. a containment cooling system is used to remove residual heat, control the pressure inside the containment and preserve the long-term integrity and leak tightness of the containment in the event of a severe accident. This dual-train system is composed primarily of the IRWST, a specific heat exchanger and heat sink and a CSS. As mentioned above, this system may also be used to cool corium in the catcher. The dispositions for practical elimination of the risk of hydrogen detonation are given above; all the containment penetrations (including the equipment hatch) lead to buildings where the inside air is ventilated and filtered. There must not be any direct leakage pathway between the containment and the outside environment. Loops that may be used to carry radioactive substances outside the containment are contained inside peripheral buildings with suitable confinement capacities. Pressure-resistant penetrations in the containment must be designed to withstand loads resulting from core melt accidents. Specific R&D programmes were required to develop the corium catcher and spreading compartment. These programmes are presented in Section Level 2 PSAs: method and lessons from core melt accidents Over the past three decades, and particularly since the Three Mile Island accident in the USA, level 2 PSAs have occupied an increasingly greater place in nuclear-reactor safety assessments in France and abroad. Level 2 PSAs are now either required or re commended by national safety regulators around the world. In the case of Generation III reactors, these requirements or recommendations apply right from the design phase. For example, EDF provided ASN with a level 2 PSA for the commissioning of its Flamanville-3 EPR. For each accident leading to core melt identified in the level 1 PSA, the level 2 PSA aims to determine, based on knowledge of the physics of core melt accidents and studies conducted with computer codes simulating such accidents, the evolution of the

37 Safety Principles for France s Pressurised Water Reactors 87 accident, possible failures of the containment and the range and kinetics of radioactive releases into the environment with the corresponding probabilities. Level 2 PSAs therefore make it possible to assess the type and extent of radioactive releases outside the containment that could be caused by core melt with the corresponding frequencies and contribute to assessing the overall safety of the facility. They make it possible to verify that the estimated frequencies of accidents that could lead to large releases to the environment are very low. Level 2 PSAs are also used to assess the benefits of improvements to equipment (and particularly to existing systems) and procedures designed to reduce the probabilities of containment failure modes or mitigate the consequences of such failures in terms of releases. They may also contribute to the definition and introduction of systems for preventing severe accidents and mitigating their consequences as well as for improving the GIAG. Lastly, they may also contribute to identifying and setting priorities for research programmes designed to improve understanding and modelling of the physics of core melt accidents. In France, EDF and IRSN each developed level 2 PSAs for the 900 MWe reactors and, more recently, the 1300 MWe reactors. The PSAs developed by EDF are reference studies. In the period , the level 2 PSAs were used in particular to review safety during the third ten-yearly outages of the 900 MWe reactors. The rest of this section presents, for illustrative purposes, the method used by IRSN and gives examples of application of the level 2 PSA for the 900 MWe reactors as part of the safety reviews Level 1 Level 2 Level 2 Level 1 Level 2 Figure 4.8. Method used for the level 2 PSA conducted by IRSN for the 900 MWe reactors.

38 88 Nuclear Power Reactor Core Melt Accidents conducted during the third ten-yearly outages of these reactors. This method is presented in Figure 4.8 and described in the following sections Methods of conducting level 2 PSAs Interface with the level 1 PSA Creating an interface with the level 1 PSA is the first step in carrying out a level 2 PSA. This interface must: ensure transmission of information on the state of the affected unit at the end of the level 1 PSA (particularly the state of the engineered safety systems, the containment, the RCS pressure, etc.) that might significantly affect the subsequent evolution of the accident and the possible containment failure modes and the extent of the releases in particular; group together sequences in the level 1 PSA (which generally has several thousand sequences) when they lead to an equivalent subsequent progression. Sequences having the same set of interface variables are grouped together in the same plant damage state (PDS). The PDSs adopted make up the initiators of the event trees in the level 2 PSAs. Depending on the study methods used and the desired level of detail, as many as several dozen or several hundred PDSs may be considered when carrying out a level 2 PSA. For example, in the case of the level 2 PSA conducted by IRSN for the 900 MWe reactors (known as EPS2 REP900), a little more than 300 PDSs were defined to group together the level 1 PSA sequences leading to core melt Severe accident event tree The central element of the level 2 PSA is the event tree. This tree is used to describe all the events that may affect the progression of the severe accident up to the release of radioactive substances to the environment. The events in this tree may correspond to: physical events (core degradation and formation of a corium pool; cladding oxidation and hydrogen production; formation of breaks in the RCS for high-pressure accidents; steam explosions that may lead to failure of the reactor vessel and possibly the containment; direct heating of the gases in the containment due to a pressure failure in the vessel and leading to containment failure; corium erosion of the concrete basemat; mechanical failure of the containment; release of radioactive substances outside the core and their transfer into the facility); human actions such as recovery of a means of water injection for in-vessel cooling of the core or corium; depressurisation of the RCS; recovery of cooling by the steam generators; actuation of the CSS; actuation of the containment filtered venting system as well as errors in implementing the GIAG; system failures.

39 Safety Principles for France s Pressurised Water Reactors 89 Once constructed, the event tree is used to determine, for each PDS, the various possible ways in which the accident may progress and the potential losses of containment integrity as well as assess the corresponding radioactive releases with their frequencies. The models associated with the events are used to: assign conditional probabilities, particularly to human actions (success or failure of the action based on the quality of the available information, lead times, complexity of the decision process and the actions to be taken) or equipment failures; update the state of the facility following the event (e.g., state of containment integrity after an energetic phenomenon). Models of physical events are developed primarily from numerical simulations conducted with tools such as the ASTEC code presented in Chapter 8 of this document. Quantification of the events thus requires a large number of support studies (Section ) designed to best determine the plant s behaviour. IRSN s level 2 PSA for the 900 MWe reactors looks at more than 100 events, resulting in the quantification of the frequencies of several thousands of different sequences. In addition, a Monte Carlo algorithm is used to explain and assess uncertainties during quantification of the level 2 PSA event tree Release categories As the radioactive releases for each sequence in the level 2 PSA cannot be assessed, the sequences are grouped to obtain a limited number of release categories asso ciated with a containment failure mode as well as a range and a kinetic of the radioactive releases. The range of the releases can then be estimated using severe accident computer codes, such as ASTEC or MAAP (see Chapter 8) or simplified models developed specifically for level 2 PSAs. The various release categories and the associated frequencies make up the outcome of a level 2 PSA Level 2 PSA support studies Developing a level 2 PSA requires conducting a large number of support studies to be able to determine the progression of the different level 2 PSA sequences and quantify their frequencies. Table 4.3 presents an indicative list of the aspects to be looked at in the case of a pressurised water reactor. Drawn up as part of the ASAMPSA2 project 15 of the 7th European Framework Programme for Research and Technological Development (FP7), this list illustrates two 15. The objective of the ASAMPSA2 (Advanced Safety Assessment Methodologies: Level 2 PSA) project was to develop best-practice guidelines for the development and implementation of level 2 PSAs based on feedback from 21 European partners involved in reactor safety. The project ended in 2012.

40 90 Nuclear Power Reactor Core Melt Accidents facts: (i) defining and conducting support studies make up most of the work involved in conducting level 2 PSAs and (ii) these support studies are largely based on research findings in the field of severe accidents. More information on this is provided in the subsequent chapters of this document. While creating an event tree, determining the frequencies of the various categories of radioactive release and presenting the study findings constitute a smaller workload, they require methods that are specifically developed to the applications envisaged for level 2 PSAs. Table 4.3. Studies required in order to conduct a level 2 PSA for a PWR. Level 1 PSA/level 2 PSA interface Level 1 PSA sequences are grouped together into PDSs that lead to the same type of severe accident progression, particularly in terms of containment failure mode and extent of the releases. Transients leading to core melt are investigated. Human reliability analysis (HRA) Identification of the human actions that may occur during the sequence (actions set out in the operating guidelines, emergency-response support, system recovery, etc.). Quantification of the probabilities of failure of the various actions set out in the operating procedures. Quantification of the physical phenomena and resulting loads for the containment In-vessel accident progression phase Definition and calculation of representative thermal-hydraulic sequences for each PDS. Fuel degradation. Rupture of the RCS including rupture of the steam generator tubes induced by a high-pressure core melt accident. Hydrogen production. Restoration of core cooling (reinjection of water in the core). Vessel cooling from outside through flooding of the reactor pit. Investigation of the consequences of in-vessel water injection (corium cooling, increase in the kinetics of the production of hydrogen by oxidation of the zirconium in the fuel cladding, rise in vessel pressure, etc.). Investigation of the composition of the containment atmosphere (role of the hydrogen recombiners and the CSS) and possible rise in the containment pressure. Effect of opening of the containment filtered venting system. Studies of the distribution and combustion of the hydrogen released into the containment. Investigation of the risk of criticality from corium. Investigation of the possibilities of in-vessel steam explosion and the associated consequences (leak in the RCS, mechanical failure of the vessel, loss of containment integrity). Investigation of a vessel rupture (mechanical failure) (time before rupture, type of rupture, etc.). Quantification of the physical phenomena and resulting loads for the containment Vessel rupture phase Investigation of the phenomenon of direct containment heating if the vessel ruptures while it is pressurised. Investigation of the consequences of a steam explosion in the reactor pit. Investigation of the risk of criticality from corium.

41 Safety Principles for France s Pressurised Water Reactors 91 Quantification of the physical phenomena and resulting loads for the containment Ex-vessel phase (MCCI) Corium coolability. Radial and axial erosion of the reactor pit walls and basemat (MCCI). Impact of water injection (corium cooling, rise in containment pressure). Assessment of the production of noncondensable gases (H 2, CO, CO 2, etc.) and steam during the MCCI. Investigation of the change in the composition and pressure of the containment atmosphere. Investigation of the distribution and combustion of hydrogen and carbon monoxide released into the containment. Effects of opening of the containment filtered venting system. Investigation of containment performance (integrity) Investigation of the initial leakage rate (normal leakage rate, possible losses of integrity of some devices between periodic tests). Investigation of the reliability of the containment isolation system. Assessment of containment performance (integrity) under severe accident conditions. 1 Mechanical response of the containment when subjected to quasi-static or slow pressure or temperature loads Assessment of the maximum mechanical strength and fragility curves of the containment. Break size assessment. 2 Assessment of the response of the containment assumed to be subjected to specific loads (effects of a steam explosion in the reactor pit on the adjacent structures, effects of a local hydrogen deflagration, etc.). Assessment of containment penetration performance (integrity) under severe accident conditions. Identification of possible containment bypasses (e.g., pipes in the basemats of some containments). Investigation of containment in the auxiliary buildings (ventilation, filtration, dynamic containment, etc.). Investigation of systems behaviour under severe accident conditions Sump water recirculation and cooling system (removal of heat from the containment). RCS safety valves (reliability of RCS depressurisation under severe accident conditions). Steam generators (integrity of the steam generator tubes, steam generator cooling efficiency). Instrumentation (availability of the reactor instrumentation under severe accident conditions). Passive systems (hydrogen recombiners, etc.) Core catcher (EPRs). Quantification of radioactive releases outside the containment Identification of key parameters for source-term assessment and definition of release categories. Categorisation of fission product (FP) isotopes according to three volatility class (volatile FPs, noble gases, and semi-volatile or low-volatile FPs; see Section 5.5 for more information) and their physical form (aerosol or gas) in the containment. Calculation of releases for representative sequences (use of integral codes such as ASTEC, MAAP or MELCOR (see Chapter 8), or use of simplified models developed specifically for level 2 PSAs. Calculation of the radiological consequences for the level 2 PSA release categories (optional depending on the presentation of the level 2 PSA findings).

42 92 Nuclear Power Reactor Core Melt Accidents Applications of level 2 PSAs in France Conducting a level 2 PSA entails conducting highly comprehensive studies on the expected behaviour of a facility in the event of reactor core melt. These studies may be used to support identification of ways to improve reactor safety through better design or operation. Nevertheless, the numerical results of level 2 PSAs should be interpreted with great caution and associated, wherever possible, with an assessment of the uncertainties and considerations on the accuracy of the underlying assumptions (simplifications may be necessary for a level 2 PSA conducted during the design stage of a reactor whereas more detailed studies may be conducted at a later time once the design and operating procedures have been completed) Use of level 2 PSAs during safety analyses The 2002 basic safety rule (BSF) on the development and use of PSAs [5] established that PSAs, known as reference PSAs, must be carried out by the licensees of nuclear power plants and be submitted to ASN. As a result, IRSN reviewed these PSAs using independent studies of the same type. Level 2 PSAs were used for the first time in a safety analysis, for reactors in operation, in the safety review associated with the third ten-yearly outages of EDF s 900 MWe reactors (VD3 900) between 2004 and The analysis of the level 2 PSA showed the main sequences that contribute to the risk of radioactive releases and the points for which design or operating changes had to be studied or implemented. A few examples are described in Section below. Since this first application, a level 2 PSA has been conducted for the safety review associated with the third ten-yearly outages of EDF s 1300 MWe reactors (VD3 1300) between 2010 and Level 2 PSAs are planned for all the following reviews Examples of application within the context of the safety review for 900 MWe reactors Reinforcement of the equipment hatch The containment of the 900 MWe reactors are designed to ensure their mechanical integrity and leak tightness against an absolute internal pressure of approx. 5 bar. Each containment is equipped with an internal steel liner to ensure its leak tightness. The mechanical integrity and leak tightness of the containments are checked periodically, particularly during the ten-yearly tests (tests at 5 bar absolute in air, see Section 6.2). Considering the vital role the containment can play in controlling severe accidents and their consequences, it was found appropriate to assess the ultimate mechanical strength of the containments beyond their design-basis pressure. As a result, mechanical strength tests were performed on containment models and detailed models for assessing the mechanical behaviour of these containments were developed (Figure 4.9). The findings of this research and studies are discussed more in detail in Section 6.3 of this document.

43 Safety Principles for France s Pressurised Water Reactors 93 Figure 4.9. Example of models of the containments of the CPY 900 MWe units used to conduct detailed mechanical studies of these containments and illustrating in particular the detailed modelling performed for the equipment hatch. Based on the results of the mechanical strength tests performed on the models and the results of the numerical simulations, IRSN and EDF deduced that the walls of the containments retained a satisfactory level of mechanical strength and leak tightness up to pressures well above their design-basis pressure (approx. 10 bar absolute) but that the equipment hatch closure system was a relative weak spot. While developing its level 2 PSA for the 900 MWe PWRs, IRSN conducted detailed mechanical studies of the containment by constructing a fine-mesh model of the singular zones of the containment, particularly the equipment hatch. The results of these studies showed that, for some phenomena that may occur during a severe accident (direct containment heating [DCH] following mechanical failure of the pressurised vessel, hydrogen combustion after reflooding of the in-vessel core), the calculated loadings could jeopardise the integrity of the equipment hatch closure system. Drawing on the results of these mechanical studies, the level 2 PSAs showed that these energetic phenomena (DCH, hydrogen combustion) that lead to a sharp rise in containment pressure contributed significantly to the risk of radioactive releases. This conclusion led the licensee to reinforce the equipment hatch during the third ten-yearly outages. The planned reinforcement will make it possible to ensure the integrity of the equipment hatch up to a pressure of 8 bar absolute, which is significantly higher than the design-basis pressure of the containments. Figure 4.10 shows the frequencies calculated during the level 2 PSA for the 900 MWe reactors conducted by IRSN for accidents leading to loss of containment integrity due to DCH or hydrogen combustion. Reinforcement of the equipment hatch closure system significantly reduces the risk of radioactive releases related to these energetic phenomena (frequency reduced by a few 10-7 /reactor-year). It should be noted that failure of the equipment hatch would result in direct releases to the environment.